My twins were seven years old when they figured out how to use my editing workstation. I walked back into my office one afternoon to find them proudly showing each other something on the screen, and my stomach dropped when I saw the folder they’d been clicking through. A full set of client proofs, 340 selects from a corporate headshot session, gone. Dragged to the trash and emptied, with that cheerful little crunching sound macOS makes.

I had them restored in 90 seconds. Not because I’m a wizard. Because I’d built a system where losing files from one location meant almost nothing.

That’s the goal. Not to avoid disaster, but to make disaster irrelevant.

Why Hard Drives Fail in Ways That Don’t Announce Themselves

Most photographers treat backup like insurance they hope they’ll never need. The problem is they also treat it like something that can wait until next month. Hard drives don’t care about your timeline. The average consumer-grade spinning disk has a mean time between failures of roughly 3 to 5 years, but that’s a statistical average, not a guarantee. I’ve seen 6-month-old drives die. I’ve seen 8-year-old drives keep humming. The failure curve is unpredictable, and SSDs, while faster and more durable against physical shock, are not immune. They can fail silently, writing corrupted data without ever throwing an error until you try to open a file that matters.

Equally dangerous is what I call the “one good backup” trap. Photographers buy an external drive, set up a nightly clone, and call it done. But a clone that lives next to your working drive is vulnerable to the same fire, theft, flood, or power surge. You haven’t built redundancy. You’ve built a spare tire that’s stored in the trunk of the car that just went off the bridge.

The Actual System: 3-2-1 Plus One Offsite Cloud Layer

The 3-2-1 rule is a starting point, not a destination. Three copies, two different media types, one offsite. I run 3-2-1 plus a continuous cloud sync, which sounds excessive until the day you need it.

Here’s what that looks like in practice. My working files live on a primary NAS, a Synology DS920+ with four 8TB IronWolf drives configured as RAID 5. That gives me roughly 22TB of usable space and survives a single drive failure without data loss. Cost when I built it out: around $1,100 for the unit plus about $800 for the drives. Not cheap, but I bill six figures annually. The math is simple.

From there, Carbon Copy Cloner runs an automated task every night at 11 PM, cloning the NAS to a single 18TB WD My Cloud sitting on a shelf across the room. Not perfect, but it’s fast to restore from and handles the “accidental deletion” scenario, which is by far the most common failure mode I deal with.

The offsite piece is a second NAS at my sister’s house in Oakland, synced weekly over a VPN using Synology’s built-in Hyper Backup. It runs on Sunday nights, takes about 40 minutes over her fiber connection, and I haven’t had to think about it since I set it up two years ago.

Then there’s Backblaze B2 for cloud storage, which currently holds about 4.2TB of my most critical archive files, running me $25 a month. I don’t back up everything to the cloud, only delivered client work, contracts, and final exports. Raw files from jobs older than three years stay on local drives only.

Ingestion Is Where Most People Lose the Game

The backup system doesn’t matter if you corrupt your data before it ever gets backed up. Card ingestion is the highest-risk moment in the entire workflow, and most photographers treat it like a formality.

I use Photo Mechanic for ingestion, configured to write to two separate locations simultaneously during import: the working folder on the NAS and a dedicated “fresh ingest” folder on a second local SSD. This is not a backup step. This is a redundancy step during the moment of highest vulnerability. The copy to the second SSD costs me nothing except the price of a 2TB Samsung T7 ($130) and about 4 extra minutes per job.

I do not format cards until both copies have been verified. Photo Mechanic has a built-in checksum verification. I use it. Every time. No exceptions. This habit started after a 2008 wedding where a corrupted card cost me most of a ceremony sequence and a relationship with a client I’d worked with for three years. I’ve never formatted an unverified card since.

Monthly Tests Are the Habit Nobody Does and Everyone Should

A backup you’ve never tested is a backup you don’t actually have. Once a month, I pull a random folder from my Synology NAS, open ten files at random, and verify they render correctly in Lightroom. Once a quarter, I do a full test restore from the offsite NAS, pulling an entire job folder and confirming it opens cleanly. This takes 20 minutes, maximum.

I keep a simple log in a notes app: the date, what I tested, and whether it passed. That’s it. Eleven minutes of work per month gives me the kind of confidence that lets me sleep before a big delivery deadline.

Set a recurring calendar reminder. Make it non-negotiable. Your future self, the one staring at a dead drive the night before a client presentation, will have something to thank you for.

The Part That Doesn’t Cost Anything

Every photographer I’ve mentored who lost work irreversibly had a backup system. It just wasn’t tested, wasn’t current, or had a single point of failure they hadn’t thought through. The hardware isn’t the hard part. The discipline is.

Build the redundancy, automate what you can, and test it like your business depends on it, because it does.